403 Resource protected by organization SAML enforcement

[nibanks]

Describe the bug

I followed the steps here to add a scorecard action to microsoft/msquic with this PR. The Action passed on the PR.

After I merged the PR, the action failed though:

Event file: /github/workflow/event.json
Event name: push
Ref: refs/heads/main
Private repository: false
Publication enabled: true
Format: sarif
Policy file: /policy.yml
2022/01/20 20:05:01 repo unreachable: GET https://api.github.com/repos/microsoft/msquic: 403 Resource protected by organization SAML enforcement. You must grant your Personal Access token access to this organization. []
panic: repo unreachable: GET https://api.github.com/repos/microsoft/msquic: 403 Resource protected by organization SAML enforcement. You must grant your Personal Access token access to this organization. []

I just double checked my PAT and it exactly matches what is required per the setup instructions. What am I doing wrong? Is the Microsoft organization doing something special on push runs to prevent this from working?

The only difference on my end is that publication is disabled for PRs, but enabled on push to main. Does the above only execute when publication is enabled?

[azeemshaikh38]

Thanks for bringing this to our attention @nibanks. Is it possible that SAML authentication is enabled on your GitHub organization? If so, you'll need to follow the instructions here to give the right access to your PAT.

Let me know if that works. I did some preliminary digging to find this info.

@laurentsimon this is an interesting corner case. We should look into it and document it for the users.

[nibanks]

Ah, yes. The Microsoft org does use SSO. I just enabled that for the PAT and reran the latest workflow and it passed. So I'd definitely update the PAT instructions to note this edge case and how to fix for it.

Thanks!

[laurentsimon]

cc @olivekl

[azeemshaikh38]

Thanks for confirming @nibanks. @olivekl @laurentsimon assigning this to you both. Let's update the documentation before closing this issue.